Security Bulletin: IBM Sterling Connect:Direct File Agent is vulnerable to a denial of service due to IBM Runtime Environment Java Technology Edition (CVE-2022-21626)

Summary There is a vulnerability in IBM Runtime Environment Java Technology Edition, Version 7 and 8 used by IBM Sterling Connect:Direct File Agent. IBM Sterling Connect:Direct File Agent has addressed the issue. Vulnerability Details CVEID:CVE-2022-21626 DESCRIPTION: An unspecified vulnerability...

CVE-2022-37719

A Cross-Site Request Forgery CSRF in the management portal of JetNexus/EdgeNexus ADC 4.2.8 allows attackers to escalate privileges and execute arbitrary code via unspecified vectors...

CVE-2022-37718

The management portal component of JetNexus/EdgeNexus ADC 4.2.8 was discovered to contain a command injection vulnerability. This vulnerability allows authenticated attackers to execute arbitrary commands through a specially crafted payload. This vulnerability can also be exploited from an...

CVE-2022-38110

In Database Performance Analyzer DPA 2022.4 and older releases, certain URL vectors are susceptible to authenticated reflected cross-site scripting...

Cross site scripting

In Database Performance Analyzer DPA 2022.4 and older releases, certain URL vectors are susceptible to authenticated reflected cross-site scripting...

CVE-2022-38110

SolarWinds Database Performance Analyzer (DPA) versions 2022.4 and older are vulnerable to authenticated reflected cross‑site scripting via certain URL vectors. The root cause is exposure of URL handling that can reflect input back to authenticated users, enabling XSS within affected sessions. Af...

CVE-2022-38110 Reflected Cross-Site Scripting Vulnerability

In Database Performance Analyzer DPA 2022.4 and older releases, certain URL vectors are susceptible to authenticated reflected cross-site scripting...

CVE-2022-39187

Rumpus - FTP server version 9.0.7.1 has a Reflected cross-site scripting RXSS vulnerability through unspecified vectors...

CVE-2022-39187

Rumpus - FTP server version 9.0.7.1 has a Reflected cross-site scripting RXSS vulnerability through unspecified vectors...

CVE-2022-39183

Moodle Plugin - SAML Auth may allow Open Redirect through unspecified vectors...

Open redirect

Moodle Plugin - SAML Auth may allow Open Redirect through unspecified vectors...

Cross site scripting

Rumpus - FTP server version 9.0.7.1 has a Reflected cross-site scripting RXSS vulnerability through unspecified vectors...

CVE-2022-39183

Moodle Plugin - SAML Auth may allow Open Redirect through unspecified vectors...

CVE-2022-39183 Moodle Plugin - SAML Auth Open Redirect

Moodle Plugin - SAML Auth may allow Open Redirect through unspecified vectors...

New Study Uncovers Text-to-SQL Model Vulnerabilities Allowing Data Theft and DoS Attacks

A group of academics has demonstrated novel attacks that leverage Text-to-SQL models to produce malicious code that could enable adversaries to glean sensitive information and stage denial-of-service DoS attacks. "To better interact with users, a wide range of database applications employ AI...

SUSE-RU-2022:4567-1 Recommended update for python-crcmod, python-cryptography, python-cryptography-vectors

This update for python-crcmod, python-cryptography, python-cryptography-vectors contains the following fixes: python-cryptography: - Update in SLE-15 bsc1177083, jscPM-2730, jscSLE-18312 - Refresh patches for new version Using the Fernet class to symmetrically encrypt multi gigabyte values...

Security Bulletin: Multiple Vulnerabilities in CloudPak for Watson AIOPs

Summary Multiple vulnerabilities were fixed in IBM Cloud Pak for Watson AIOps version 3.6. Vulnerability Details CVEID:CVE-2018-8023 DESCRIPTION: Apache Mesos could allow a remote attacker to obtain sensitive information, caused by a timing attack in the JSON Web Token JWT implementation. By...

CVE-2022-38628

Nortek Linear eMerge E3-Series 0.32-08f, 0.32-07p, 0.32-07e, 0.32-09c, 0.32-09b, 0.32-09a, and 0.32-08e were discovered to contain a cross-site scripting XSS vulnerability which is chained with a local session fixation. This vulnerability allows attackers to escalate privileges via unspecified...

CVE-2022-38628

Nortek Linear eMerge E3-Series 0.32-08f, 0.32-07p, 0.32-07e, 0.32-09c, 0.32-09b, 0.32-09a, and 0.32-08e were discovered to contain a cross-site scripting XSS vulnerability which is chained with a local session fixation. This vulnerability allows attackers to escalate privileges via unspecified...

Breaking the silence - Recent Truebot activity

Since August 2022, we have seen an increase in infections of Truebot aka Silence.Downloader malware. Truebot was first identified in 2017 and researchers have linked it to a threat actor called Silence Group that is responsible for several high-impact attacks on financial institutions in several...